Sources & method

This is a learning artifact built by an engineer approaching FedRAMP from the outside, in the open. It is not affiliated with, or endorsed by, GSA or the FedRAMP program. The experts — FedRAMP's program office and the practitioners who do this daily — are the authorities; this tool is a lens on their published data. New to FedRAMP? Start with the 10-minute explainer.

Method

Data, not prose: every figure in the tool is computed — in your browser — from FedRAMP's own machine-readable publications: the data feed behind marketplace.fedramp.gov and the Consolidated Rules for 2026 as JSON. A bundled snapshot loads first; "fetch live" recomputes from the source feeds with the same code.
Cited or cut: every factual claim in the explainer links to a numbered source below. Each URL was individually verified to return HTTP 200 on 2026-08-15 (fedramp.gov was restructured in June 2026 and many older links now 404 — nothing here is cited from memory). A link auditor (tools/check-links.mjs) re-verifies them.
Journey durations: a service's "days to authorized" is the gap between its first in-process-type event and its first certified/authorized event in FedRAMP's published status-change log. Journeys without a measurable start or finish are excluded and counted, never silently dropped. Migration-era records carry coarser dates; the 20x-path sample is still small — treat the comparison as directional.
The snapshots are a public mini-API: the pruned JSON bundles this site ships are CORS-open and documented in docs/data, refreshed weekly by CI. You're welcome to build on them — or go straight to the official repos.

Security & the live-data trust model

Live mode first resolves each FedRAMP repository's branch head through GitHub, then fetches only that immutable commit through one of two mirrors. The exact commit, verified Git blob, download URL, byte count, and pre-parse SHA-256 digest are shown in the Pulse provenance panel. All three feeds — marketplace, changelog, and KSI rules — are transformed and swapped atomically, so a partial refresh can never mix vintages. Every string is sanitized at ingestion and escaped at render, and the site's Content-Security-Policy limits network access to those endpoints — but if you require an authoritative system of record, use the official Marketplace. Inline scripts and inline styles are both disallowed. There are no analytics, trackers, third-party scripts, or fonts anywhere on this site — the CSP makes that a guarantee, not a promise.

What this tool deliberately doesn't claim

No official cost figures for FedRAMP authorization exist (FedRAMP declined to require cost reporting in RFC-0019), so this tool publishes none. Exact KSI and control counts shift as RFCs adopt — the tool counts them from the live rules file instead of asserting them. And it makes no claims about any specific company's compliance strategy — the Marketplace data speaks for itself. Corrections are welcome: open an issue.

Sources

The complete registry — every source this site is allowed to cite. All verified live on 2026-08-15.